Using cryptography correctly in Python
With the cryptography library you set up encryption, signatures, password storage and key handling correctly, and see the common mistakes for yourself.
Level 201 · 15 lessons · 12 practice labs
Lessons
Building blocks
- Secure randomness with secrets, and why random is not enough
- Message integrity with HMAC
- Constant-time comparison and timing leaks
- Short task: generate a signed, expiring link token
Encryption
- Easy, safe symmetric encryption with Fernet
- AES-GCM: nonces, associated data and authentication
- Common mistakes: ECB mode and nonce reuse
- Encrypting large files in chunks
- Short task: find and fix broken encryption code
Keys, signatures, passwords
- Signing and verifying with Ed25519
- Reading RSA keys and X.509 certificates
- Storing passwords with argon2 and scrypt
- Keeping keys in the right place, not in code
- Short task: migrate old MD5 password hashes to argon2 safely
Wrap-up
- Capstone: a small encrypted vault tool for passwords and files
Practice labs
- Predictable reset codes: Rewrite a function that makes password reset codes with the random module to use secrets, and show with a test that new codes meet the length and character-set requirement.
- Move MD5 passwords to argon2: Change login code that uses old MD5 hashes so it rehashes the password with argon2 on successful login, and show with tests that both kinds of account can sign in.
- A small encrypted vault: Write a command-line vault that derives a key from a master password with scrypt, stores entries with AES-GCM and refuses to open a tampered file, and show the key is never stored in plain text.
- Verify a webhook signature: Write a function that verifies incoming webhook requests with HMAC-SHA256 and a shared key, use constant-time comparison and show a tampered request is rejected.
- A signed, expiring download link: Generate a token for Caravan Travel ticket download links that signs user, file and expiry, and show expired or altered links are rejected.
- A timing leak in a comparison: Measure response times on a lab service that compares the API key with ==, show the difference, fix the code with hmac.compare_digest and prove the measurement no longer tells keys apart.
- Encrypt the passwords in a config file: Write a helper that encrypts a config file containing plaintext passwords with Fernet and decrypts it at app start, and show a wrong key gives a clear error.
- Records encrypted in ECB mode: Show that code encrypting customer records with AES-ECB turns equal fields into equal ciphertext, move it to AES-GCM and write a migration script that re-encrypts old records.
- Encryption code with three bugs: Fix an encryption module that reuses a fixed nonce, does not authenticate associated data and derives the key from a password with a single SHA-256, and write a failing test for each flaw.
- Sign a release file: Write two small scripts that sign an Oakmere Studios update package with Ed25519 and verify it after download, and show a modified package is rejected.
- An inventory of certificate files: Read the PEM certificates and RSA keys in a folder and produce a table of subject, expiry, key size and which key belongs to which certificate.
- Encrypt a large file in chunks: Write a tool that encrypts backup files in chunks with AES-GCM without loading them into memory, and refuses to decrypt when chunks are reordered or one is removed.
About this course
With the cryptography library you set up encryption, signatures, password storage and key handling correctly, and see the common mistakes for yourself.
What you will learn
- Building blocks
- Encryption
- Keys, signatures, passwords
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.